The flaw in Apicurio Registry’s artifact‑write permission to submit XML payloads that contain internal DTD entity expansions. The lack of external DTD blocking and of FEATURE_SECURE_PROCESSING allow high‑volume entity tests such as the "billion‑laughs" variant to consume excessive CPU and heap, eventually rendering the registry service unreachable. This weakness is identified as CWE‑776.

The vulnerability applies to the Red Hat build of Apicurio Registry 3. No specific sub‑versions are listed beyond the major release, so any deployment matching the Red Hat build of Apicurio Registry 3 is potentially impacted.

The CVSS score of 6.5 indicates moderate severity. Because the EPSS value is missing, the exact likelihood of exploitation is unclear, yet the presence of a write permission requirement keeps the attack vector realistic for environments where users can upload artifacts. The vulnerability is not included in the CISA KEV catalog, but the absence of DTD restrictions means that internal entity abuses can still succeed consumption and possible service outages.